coordinated disclosure
termsecuritygovernance & risk
Reporting a defect privately, agreeing a deadline, and publishing after the fix - the compromise the field settled on between full disclosure and silence.
The deadline is the load-bearing part, and it exists because without one the vendor's incentive is to wait forever. It also rests on an assumption worth stating: the reporter is probably not the only person who can find this, so time spent unpatched is time somebody else may be using. The Kaminsky DNS flaw is the reference case for what the good version looks like - competing vendors patching on the same day, detail published a month later - and it is rare because it needed one researcher to organise people who do not usually cooperate.
Also known as: cvd